Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:90254
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.214.171 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAKws9z1g24rD=t92+9xKtO=3PuwQ3_N=L36gmVMqCC84CoqipQ@mail.gmail.com>
References: <CAKws9z1g24rD=t92+9xKtO=3PuwQ3_N=L36gmVMqCC84CoqipQ@mail.gmail.com>
Date: Thu, 7 Jan 2016 22:51:43 +0700
Message-ID: <CAEZPtU7-Lk=jGsTQgRZOvBpcPPgdX3V-23=3_k9CXbmxU77V1A@mail.gmail.com>
To: Scott Arciszewski <scott@paragonie.com>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC] Libsodium
From: pierre.php@gmail.com (Pierre Joye)

HI Scott,

On Thu, Jan 7, 2016 at 8:26 PM, Scott Arciszewski <scott@paragonie.com> wrote:
> Hi everyone,
>
> I've updated the RFC to make libsodium a core PHP extension in 7.1, to
> include references to the online documentation.
>
> https://wiki.php.net/rfc/libsodium
>
> All new functions and classes would exist in the Sodium namespace. e.g.
>
>     $ciphertext = \Sodium\crypto_box($message, $nonce, $keypair);

As much as I like libsodium, yet another extension with yet another
library in the core sounds like a risk to me, long term. I would
rather prefer to focus on a larger effort to provide the necessary
features in the most easiest way using new APIs or existing
extensions, as you mentioned already in previous discussions and in
this mail. That's why I won't be in favor of bundling this one.

> This is part of an overall effort to improve PHP's cryptography; up
> next will be the pluggable crypto API that supports multiple backends
> (with a scope limited to openssl and libsodium at the time of release)
> but always provide conservative defaults. Then I'd like to look at
> deprecating ext/mcrypt back to PECL and add more hash functions to
> ext/hash.

This is definitely the way. Thanks for your great work :)

Cheers,
Pierre